Subject: RE: [mobile-ip] RFC3012bis - Comments from ADs (Protocol related) (ISSUE 15)

From: "Ahmad Muhanna" <[email-masked]>
Date: Thu, 26 Sep 2002 12:13:03 -0500

please see comments inline.

Regards;

Non-editorial comments associated with RFC3012bis:

Please post your comments with the appropriate issue number in the subject
line (instead of simply replying to this email).

-Chairs.

15.    Section 8 (SPI For RADIUS AAA Servers) defines a method of computing
   the Generalized Mobile IP Authentication Extension's authenticator
   field using MD5 in a manner that is consistent with RADIUS [9].  The
   use of MD5 in the method described in Section 8 is less secure than
   HMAC-MD5 [6], and should be avoided whenever possible.

   How can it be avoided?
   There doesn't seem to be a CHAP_SPI_HMAC_MD5 defined.

It seems a good idea. 
Why not defining this as one of the reserved SPI value.

Regards,
Ahmad